As SEC Pushes for Hard Drives, Defense Lawyers Balk

The SEC has become more aggressive in seeking full hard drives from the companies and individuals it investigates, startling defense lawyers.

WASHINGTON -- The U.S. Securities and
Exchange Commission has become more aggressive in seeking full
hard drives from the companies and individuals it investigates,
startling defense lawyers who question whether the agency is
allowed to obtain such information.

The big push is an outgrowth of the SEC's new
state-of-the-art forensics lab, which gives the agency the
ability to recover altered or deleted electronic data as it
builds insider trading cases and other enforcement actions.

It is part of a larger effort by enforcement authorities,
both criminal and civil, to use bolder and more sophisticated
tools to nab fraudsters who themselves are becoming savvier.

In recent months, the term "ESD" is showing up more often in
subpoenas from the SEC, according to lawyers who have received
such requests. "ESD" refers to electronic storage devices, which
includes everything from laptops and hard drives to printers and
smartphones.

Some defense lawyers say they are contesting such subpoenas,
comparing it to the SEC asking for a whole filing cabinet,
rather than specific types of documents, which is what it
usually does.

The SEC can request books, papers, correspondence,
memoranda, or other records deemed relevant to an inquiry. The
SEC contends that electronic storage devices qualify as records.

While investigators would traditionally have balked at
getting dozens of boxes of files with little guidance on what
was in them, new technological capabilities allow the SEC to
quickly run terabytes of data through complicated search tools.

Eugene Goldman, a former SEC lawyer who is in private
practice at McDermott Will & Emery, said he received his first
request for a client's hard drive in the past six months.

"I objected to it," he said.

Goldman said he was alarmed because the hard drive would
potentially give the SEC a lot of information outside the scope
laid out by the formal order of investigation. The SEC is
considering his request to narrow the scope.

SEC spokesman John Nester said he is not aware of legal
disputes involving the agency's ability to seek hard drives.

If a defendant refuses to turn over a device, it could force
the SEC to go to court to enforce its subpoena and prove it has
the authority to request it, lawyers said.

But some lawyers said defendants might not want to pick a
public fight with the SEC and risk giving up any credit they
might get for fully cooperating with investigators. Also, some
lawyers said they believe the agency does have the right to
obtain hard drives given the agency's broad subpoena powers,
which doesn't require a judicial sign-off.

'CRITICAL SMOKING GUN'

The SEC continues to invest in its electronic discovery
efforts and its forensics lab, which opened its doors in June
2011.

Housed on the second floor of the newest wing of the SEC
headquarters in Washington, the built-to-spec forensics lab
features poured concrete walls two-feet (0.6 meter) thick with
built-in metal barriers to prevent eavesdropping, and is stocked
with powerful air conditioners and servers.

The lab is staffed with forensic analysts conducting
"digital investigations" that can recover deleted, encrypted or
damaged data or files.

"The key to just about every important SEC investigation
nowadays lies in the data that the staff find," said John Stark,
who spent two decades at the SEC, including as chief of its
office of Internet enforcement, and now helps companies respond
to requests for electronic information at Stroz Friedberg, a
technology consulting firm.

"Occasionally you have wiretaps or a whistleblower, but
generally, the critical smoking gun resides on some device as a
byte of data," he said.

Scott Friestad, associate director of the SEC's enforcement
division, said the forensic lab's work on hard drives and other
devices is especially helpful in instances where investigators
believe an individual has taken steps to conceal wrongdoing.

"I think it's a small percentage of our overall cases that
use those services, but for the ones that do, it can be
critically important," Friestad said.

As an example, he said the forensics lab could be
particularly useful in an insider trading investigation, to
determine whether someone had deleted emails or other evidence
connecting them to a corporate insider or another tippee.

'PUSHING THE ENVELOPE'

The SEC is also finding that its enhanced power to comb
through electronic devices can help it rebut arguments from
defense counsel who say such outsourced forensic searches could
be costly.

"It could be a game changer," said Thomas Sporkin, a former
SEC lawyer who led the agency's Office of Market Intelligence
and is now a partner at BuckleySandler. "If you think of the SEC
as saying, 'we can do it for free,' that could have big
implications on an entity that otherwise would have used
expense" as a way to avoid the search, he said.

That scenario played out for Howard Schiffman, a defense
attorney at Schulte, Roth & Zabel. The SEC asked for information
from the personal computer of every employee at a firm being
investigated in an insider trading case, he said.

When Schiffman said such a search could be cost prohibitive,
the SEC asked the company to turn over the computers and said it
could conduct the searches itself.

"What the SEC is doing, is asking people electronically to
look for the needle in the haystack, but lots of times there
isn't one," Schiffman said.

And while lawyers and consultants are taken aback by the
boldness of the SEC's approach, some acknowledge they are a
little impressed, too.

"It is a pretty innovative way to catch bad guys," Stark
said. "They are pushing the envelope, but it's also my job to
push back."